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Abstract. We propose a cryptographic scheme that is deterministic: Alice sends 
single photons to Bob, and each and every photon detected supplies one key bit - 
no photon is wasted. This is in marked contrast to other schemes in which a random 
process decides whether the next photon sent will contribute to the key or not. The 
determinism is achieved by preparing the photons in two-qubit states, rather than 
the one-qubit states used in conventional schemes. In particular, we consider the 
realistic situation in which one qubit is the photon polarization, the other a spatial 
alternative. Further, we show how one can exploit the deterministic nature for direct 
secure communication, that is: without the need for establishing a shared key first. 
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1. Introduction 

Cryptographic schemes based on the exchange of single photons, each carrying one bit 
of information, have been widely discussed in the literature PJ. In some of the schemes, 
Alice and Bob share entangled photon pairs 0. In others, Bob performs measurements 
on photons that Alice sends him ||. They always need to communicate via a classical 
channel as well. Experiments have shown that secure key distribution is possible indeed, 
even over a distance of several kilometers ||. |^. || . 

The standard procedures, such as the so-called BB84 protocol of ]3[, are not 
deterministic in the sense that Bob may or may not get a key bit for the next photon that 
Alice will send; on average one key bit is obtained for every two photons transmitted^. 
By contrast, the scheme we propose here, is deterministic: Bob gets a key bit for each 
and every photon sent by Alice. 

This determinism is the main advantage of our new scheme. It offers, in particular, 
the option of secure communication without first establishing a shared key. 

To achieve the determinism, Alice sends Bob photons prepared in certain two- 
qubit states, rather than photons carrying one-qubit states. She uses, for example, the 
spatial binary alternative of the photon with the basis states |R) and |L) and the two 
polarization states |v) and |h). Here, |R) and |L) describe a photon traveling in the 
"right" or the "left" fiber, respectively, and |v) and |h) refer to photons with vertical 
and horizontal polarization. 

With the aid of unitary two-qubit gates [§] , Alice can turn either one of the simple 
product states |Rv) = |R) <8> |v), |Rh), |Lv), and |Lh) into any desired superposition 
thereof, so that she can send each photon in the single-photon two-qubit state of her 
choosing. Likewise, Bob's measurements of certain sets of four mutually orthogonal 
two-qubit states are achieved by appropriate unitary gates. They transform the states 
of the measurement basis in question into the four basic product states, which are then 
easily discriminated. 

Since each photon carries two qubits now, the new scheme is not more efficient in 
terms of qubits than the standard ones: Each qubit pair sent gives one key bit. 

2. Quantum key distribution 

We present the scheme for key distribution first. It has, of course, a number of features 
in common with the BB84 protocol, but generates a key bit for every transmitted 
photon. We discuss its security against eavesdropping and observe that, despite the 
deterministic nature, it cannot be used for direct communication, that is: for sending 
a message without establishing a shared key first. We then introduce a second scheme, 
with more involved state preparation and analysis, that does enable Alice and Bob to 
communicate directly and confidentially. 

X Only few protocols try to go beyond this 50% efficiency . 
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Figure 1. Schematic view of the setup. To transmit the bit "+" or "— " Alice prepares 
a photon in one of the states |i±) and sends it to Bob. For the purpose of cryptography, 
two pairs of states are sufficient [e.g., those of @], whereas communication requires 
four pairs [those of @]. A beam splitter reroutes the photon randomly, and then 
Bob measures in which state \Bj) or \B'j) it is. In some cases, communication via the 
classical channel is required to decode the bit. 



The experimental setup of the cryptographic scheme we propose is sketched in 
Fig. [I]. To transmit one bit, "+" or "— ", Alice sends Bob a photon prepared in one of 
the four states \i±) (i = 1,2). For a "+" bit she chooses randomly between |1+) and 
|2+); for a "— " bit between [1— ) and [2— ). When the photon arrives at Bob's end, he 
randomly chooses between two different two-qubit bases for his analysis of the photon 
state. Experimentally, this can be achieved by sending the incoming photon through a 
beam splitter and rerouting it to different measurement devices as shown in Fig. [I]. Bob 
measures either the basis states \Bi), . . . , \B±) or \B[), . . . , \B' A ), and he can always 
infer the bit Alice sent. Depending on the outcome of his measurement, he might be 
able to deduce the incoming bit immediately. In some cases, classical communication is 
required, and Alice has to tell Bob whether the photon state she prepared was of type 
"1" or "2". 

For illustration, let us consider the simplest version in which the states sent by 
Alice and the states detected by Bob are all product states^] such as 

(|1+), |l->; |2+), |2-» = (|Rs), | La); |Sv), |Ah» , 
(IB,), \B 2 ), \B 3 ), \B 4 )) = (|Rv), |Rh), |Lv), |Lh» , 

(\B[),\B' 2 )AB' 3 ),\B' 4 )) =(|Ss) I |As),|Sa> I |Aa» (1) 

where 

!X} = 75 (|R>±|L>) ' !a>}=> >±|h)) (2) 

§ Therefore, this particular example could also be realized by exploiting the polarization qubits of 
paired photons. 
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Table 1. For the states of ([!]): Key bits as inferred by Bob upon learning which type 
of photon was sent by Alice. Note that Bob does not need this classical information if 
he detects the states of the 1st and 4th columns. 



photon sent 
by Alice 



state detected by Bob 



B x or B[ 



B 2 or B' 2 



B 3 or B' 3 B A or B\ 



type 1 
type 2 



+ 



+ 



are symmetric (S and s) and antisymmetric (A and a) superpositions of the basic 
alternatives. Note that each of Bob's states is orthogonal to either the "+" state or the 
"— " state of each pair; this is the essential property for the deterministic transmission. 
Suppose, for instance, that Bob detects state \B 3 ) = |Lv); it is orthogonal to |1+) = |Rs) 
and |2— ) = | Ah) and therefore it signifies "— " if a photon of type "1" was sent and "+" 
if it was of type "2" . These matters are summarized in Table [I]. 

Let us now exhibit the basic general features of our deterministic scheme, as they 
are illustrated by this particular example. How can Bob always know which bit Alice 
sent? He can distinguish the "+" states from the "— " states unambiguously if, for all 
state pairs ), each possible measurement result can only be caused by or 

but not by both. This must be the case for every basis measured by Bob. Then 
he can infer the bit transmitted as soon as Alice identifies the type of pair used (that 
is: she tells him the value of the pair label i). 

For the security of the scheme it is important that the state pairs |1±) and |2±) 
sent by Alice are neither identical nor orthogonal. It is equally important that Bob has 
more than one basis at his disposal, because this is what renders possible the detection 
of an eavesdropper. In the example (|l|), the two bases are in fact even complementary 
since the transition probabilities | (Bi\Bj) | 2 = | do not depend on the quantum numbers 

This maximal incompatibility is not really needed, but the bases should not be 
very similar to each other in order to ensure that an eavesdropper will surely cause a 
substantial number of false detections at Bob's end, as we discuss below. 

To analyze this in more detail, we consider a scheme that is somewhat more general 
than the one based on the products states ([[]). Here Bob's bases are related to each 
other by 

(\B[), \B> 2 ), \B' 3 ), = (|Si>, \B 2 ), \B 3 ), \B 4 ))K (3) 
where the 4x4 matrix K is given by 
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with a real parameter k. For brevity and simplicity, we are satisfied with discussing the 
most elementary version of the scheme, where Alice makes use of two state pairs only 
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that are given by 

|l+) = (|fl a ) + A;|fl 2 >)/vT + F, 
\l-) = (k\B 3 )-\B 4 ))/VT+&, 
\2+) = (\B 1 ) + k\B 3 ))/VT+¥ } 

\2-) = (k\B 2 )-\B i ))/y/T+¥, (5) 

More generally, she could always use four pairs, and even six pairs in some versions |J. 
Relations ([|) remain valid if the |-Bj)'s are replaced by the \B'-)'s. Note that the inverse 
of the transformation (|3|) is also furnished by K since this matrix is both Hermitian and 
unitary. For k — 1, in particular, we return to the situation of ([!]) where the two bases 
\Bj) and \B'-) are complementary. Table |1| continues to apply, irrespective of the value 
of k. 

Let us now imagine that Evan, the eavesdropper, is listening in. He intercepts each 
photon sent by Alice, performs a measurement on it, and then forwards a replacement 
photon to Bob. Evan will not be able to infer with certainty which two-qubit state is 
carried by the intercepted photon, and so he has to make an educated guess based on 
his measurement result. Then he prepares the replacement photon accordingly, namely 
in the two-qubit state that has the best chance of avoiding wrong detector clicks at 
Bob's end. If, for instance, Alice has sent a |1+) photon, then the detectors for \B 3 ) 
and | B4) as well as \B' 3 ) and \B' 4 ) would yield wrong clicks and reveal the interference 
of the eavesdropper. Thus, Evan has to solve a two-fold problem: Which basis should 
he measure, and which states should be forwarded to Bob, such that the probability for 
a wrong click is minimal? 

These questions can be answered systematically , also for more general intercept- 
resend strategies, much like the corresponding studies |K| for the BB84 protocol. (The 
generalizations do not offer a real advantage to Evan, however.) In an optimal strategy 
then, the probability that Bob will detect a wrong click is 

Pmm 2 2 1 + k 2 { ' 

All other intercept-resend strategies that Evan might employ result in larger error rates. 
The largest value obtains for k = ±1, namely = (2 — y/2)/A = 14.6%; for k = and 
k — > ±00 the minimal error rate vanishes. Both limiting cases are easily understood: 
for k = ±1 Bob's measurement bases are complementary and therefore maximally 
incompatible, and for k = or k — > ±00 they are essentially identical. We note in 
passing that, if four pairs of states are used rather than just the two pairs of (|5|), the 
minimal error rate increases to 

(4) _ l min{l,A; 2 } 

Pmin 2 1 + k 2 ' KJ 
which can be as large as 25%, and an eavesdropper's presence can then be noticed more 
easily. 

For the purposes of this letter, we continue to focus on the two-pair scheme and 
assume that Alice and Bob have wisely chosen a k value near k — 1, say. Suppose they 
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want to establish a key of 1000 bits, and Alice sends 1100 photons in two-qubit states, 
randomly chosen from the four states of (|5|). Bob detects all photons, then selects a 
random subset of 100 and tells Alice in which states he found them. If some of Bob's 
measurement results are inconsistent with the states Alice sent, such as detecting 
for a |1+) photon, then Alice doesn't trust the transmission and they start all over. If, 
however, Bob's results are all right, then Alice concludes that the likelihood that Evan 
has listened in is less than (1 — p^L) 100 = 1-3 x 10~ 7 , which she and Bob have earlier 
decided to be sufficiently small for the security level they'd like to have. Alice then 
reveals the type of each photon, "1" or "2", and Bob infers the bits sent with the aid of 
Table [l|. Thereafter they share a secure 1000-bit key string. A confidential message of 
this length can then be exchanged. 

3. Secure communication without first establishing a shared key 

Given the deterministic nature of the scheme, one might wonder if Alice couldn't send 
a message directly to Bob without first establishing a shared cryptographic key. That 
would require that Evan cannot infer the transmitted bits before Alice and Bob become 
aware of his presence. Now, Table Q tells us that Evan could acquire correct knowledge 
of every second bit sent by just performing the same measurements as Bob because 
knowledge of the photon type is not needed in the 1st and 4th columns. In fact, Evan 
can improve his educated guesses by choosing his measurement more cleverly |J, since 
the "+" states sent by Alice are distributed differently over the two-qubit Hilbert space 
than the "— " states. For the example of (|5|), he can systematically exploit the difference 
between the two-dimensional subspaces spanned by the "+" states and the "— " states to 
achieve odds as large as \ + |/Vl + k 2 for guessing the bits right, which exceeds 85% for 
k = 1. Clearly, secure direct communication is not possible under these circumstances. 

But there is a modified scheme that does enable Alice and Bob to communicate 
directly and confidentially. Again we focus on the simplest version, in which Bob's 
measurement bases are related to each other by 

/ (Bi\ \ ( 1 1 1 \ / (B[\ \ 

W J_ -1 0-1 1 (B' 2 \ 

{B 3 \ ~ v/3 -1 1 0-1 (B' 3 \ ■ 1 ) 

V {Ba\ j V -1 -1 1 A (B' A \ J 

Just like K of @, the 4x4 transformation matrix appearing here is Hermitian and 
unitary, so that it also furnishes the inverse transformation. The states sent by Alice 
now are identical with Bob's basis states, grouped into four pairs of orthogonal states 
in accordance with 

= \Bi) , \i-) = \B[) for % = 1, 2, 3, 4 . (9) 

The basic features discussed above in the paragraphs between (Q) and (|3]) are here 
present as well. 
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Table 2. For the states of (||) and (^): Key bits as inferred by Bob upon learning 
which type of photon was sent by Alice. 



photon sent 
by Alice 


state detected by Bob 
B\ B 2 B 3 £? 4 B[ B' 2 B' 3 B' 4 


type 1 
type 2 
type 3 
type 4 


+ -- - - + + + 
- + -- + - + + 
-- + - + + - + 
--- + + + + - 



Table 3. Direct confidential communication. Alice chooses a random key sequence 
of 1,2,3,4 (1st row) and matches it with the bit sequence of the message (2nd row) 
interspersed with randomly located control bits (boxed) to determined the sequence of 
states to be sent (3rd row). Bob obtains a sequence of detected states (4th row). The 
control bits are used to test for the presence of an eavesdropper. After Alice reveals 
the random sequence of the 1st row, Bob can then reconstruct the message of the 2nd 
row. 
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How Bob infers the bits sent is summarized in Table |^. Consider, for example, that 
he found a certain photon in state \Bs). He'll infer that "+" was sent if Alice tells him 
that it was a type-3 photon because \B 3 ) is orthogonal to |3— ), and that "— " was sent 
if it was of type 1, 2, or 4 because \B 3 ) is orthogonal to |1+), |2+), and |4+). 

Now, the minimal error rate resulting from eavesdropping of the intercept-resend 
kind is | = 16.7% for (|5|) with (g), which is less than the 25% of the four-pair key-sharing 
scheme to which (^) refers, but more than the 14.6% of the two-pair versionjf]]. Thus, 
Evan's interference can be detected just as easily in the present scheme of (^) and (|8|) 
as in the previous one of (|]) and (fl) or of ([!]). Therefore, the scheme defined by ([|]) and 
(§) could be used for secure key distribution. 

But this scheme is also well suited for direct communication, since the four "+" 
states span the whole two-qubit Hilbert space uniformly, and the four "— " states do so 
as well. Thus, Evan cannot distinguish "+" photons from "— " photons here without 
knowing the photon type. In particular, although the columns of Table |^ have 3:1 ratios 
of the signs, both kinds carry equal weight. If, for example, \B 3 ) is detected then |3+) 
is as likely as |1— ), |2— ), and |4— ) together. 

Direct confidential communication is achieved as follows; see Table [| Step one: 

|| These error rates refer to the situation in which Evan wishes to find out the value of each bit 
transmitted. Instead, he could settle for just a reasonable likelihood for guessing the bit value right 
and bargain for a reduced error rate in return. A detailed discussion of compromises of this kind will 
be presented elsewhere. 



Secure communication with single-photon two-qubit states 



8 



Alice generates, at her end, a random sequence of 1,2,3,4 that will serve as the 
cryptographic key. Only Alice knows this key. Step two: She matches this sequence 
with the string of +/— message bits, interspersed with a fair number of control bits 
at random positions, and so determines the two-qubit states to be sent to Bob. Only 
Alice knows which bits are control bits and which are message bits. Step three: Alice 
sends the photons in these states, and Bob detects them in one of the states of his 
measurement bases. Step four: Alice tells Bob which photons carried control bits, and 
he tells her in which state he found them. Step five: Alice verifies that Bob's findings 
are consistent with what she sent. If no inconsistencies — that is: errors — are noticed, 
Alice concludes that the transmission was secure and continues with step six; otherwise 
she repeats the procedure beginning with step one. Step six: Alice reveals the key 
sequence of step one, and Bob reconstructs the message with the aid of Table §. 

This scheme for direct communication is secure because Alice does not reveal her key 
sequence until she has convinced herself that Evan has not been listening in. Without 
this classical information, Evan cannot infer a single bit of the message. The only bits 
he might decode before his presence is detected are the control bits which, however, are 
not part of the confidential message. 

4. Final remarks 

Experimental implementations of our schemes for key distribution and direct 
communication can be realized with the aid of the universal two-qubit gates that where 
introduced recently ||. Concerning practical aspects, we remark that we gain a factor 
of two compared to other cryptography schemes even for imperfect transmission and 
detection. Redundant encoding can overcome the losses in the communication scheme 
without revealing information to the eavesdropper. We'd also like to note that, rather 
than using two binary alternatives of single photons, one could, of course, equally well 
exploit the states of any other four- dimensional Hilbert space. 

In summary, we propose a new cryptographic scheme. Under ideal conditions, the 
scheme is deterministic: Alice and Bob get a key bit for each photon sent, whereas 
other schemes ||, |3| need at least two photons and are not deterministic. A significant 
percentage of Bob's measurement results will be wrong if an eavesdropper intercepts 
the transmission, so that his presence can surely be noticed. In addition, we show how 
the encoding and deterministic decoding of qubits in a four-dimensional Hilbert space 
allows direct communication, even without first establishing a shared key. 
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